This vulnerability in LogonTracer before version 2.0.0 allows specially crafted Windows event log data to cause cypher injection, leading to potential unauthorized alteration of the database contents. The issue stems from improper neutralization of special elements in the data query logic. The CVSS 3.0 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. No official fix or patch information is currently provided by the vendor.

The impact is limited to integrity, where an attacker can alter database contents by injecting malicious data through specially crafted Windows event logs. There is no impact on confidentiality or availability. The vulnerability requires user interaction and can be exploited remotely without privileges, but the attack complexity is low. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid loading untrusted or specially crafted Windows event log data into LogonTracer versions prior to 2.0.0. Monitor vendor communications for updates on patches or mitigations.